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ABSTRACT 


The object of this study was to recommend possible improvements in the 
manner in which structural integrity of Army systems is assured. The 
elements of a structural integrity program are described, and relevant 
practices used in various industries and government organizations are 
reviewed. Some case histories of Army weapon systems are examined. The 
mandatory imposition of a structural integrity program patterned after the 
Air Force Aircraft Structural Integrity Program is recommended and the 
benefits of such an action are identified. 
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SUMMARY 


The NMAB Committee on Assurance of Structural Integrity was formed to 
investigate and document the need for a formal structural integrity 
assurance program for employment by the U.S. Army. The perceived need for 
such a program stems from occasional structural failures in Army weapons and 
transportation systems, which, although few in number, have had a 
significant cumulative impact economically, in terms of injuries or death to 
personnel or upon mission success. 

As a result of a review of failures as well as of procedures employed in 
industry and government to preclude failures, a strong committee consensus 
developed suggesting that a formal structural integrity assurance program 
would be highly desirable in Army system development and procurement. 
Important features of a recommended structural integrity program are 
proposed whereby the basic pattern of existing Air Force regulations 
(ASIP/ENSIP) is followed, but allowing more flexibility in implementation 
because of the wide diversity of Army equipment and systems. Details of the 
organization and operational aspects of such a program were not considered 
in the belief that the committee recommendations might best be achieved by 
the full and direct involvement of the Army itself in developing the 
detailed plan. 

Finally, the committee report summarizes anticipated payoffs and 
benefits of the proposed program in terms of the major reasons for its 
implementation, which include cost, safety, readiness, visibility, 
maintenance, and political factors. 
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INTRODUCTION 

The sudden and unexpected failure of engineering structures can have serious 
human and economic consequences. Numerous examples can be cited where the 
loss of life is high and the resulting costs are severe. The walkway 
collapse at the Hyatt-Regency Hotel in Kansas City (National Bureau of 
Standards 1982), the American Airlines DC-10 engine separation and crash in 
Chicago (National Transportation Safety Board 1979), and the 1-95 bridge 
failure in Connecticut (Newsweek 1983) are examples of major failures that 
have compromised public safety. 

Many other premature failures occurring in structural components may 
pass unnoticed by the public but may have important economic consequences 
for the manufacturer, the user, or the taxpayer. The collapse of welded oil 
storage tanks (National Research Council 1953a) and the sudden fracture of 
large generator rotors (Schabtach et al. 1955), events that occurred in the 
1950s, are representative of very costly component failures. 

Visibility — public awareness — is another concern in reckoning with the 
possibility of sudden failure. Perhaps no event is more visible to the 
public than the launching of man into space. The subsequent political and 
programmatic consequences of a structural failure at the time that national 
television is giving its full attention to the event can be anticipated to 
be extreme. Safety, cost, and visibility are only three of many factors on 
which this class of failures impact. 

The causes of such failures are many, and examples of each will be 
presented here. They include: 

1. Improper recognition of loading conditions. 

2. Material and design factors contributing to instability. 

3. Quality of manufacture of the finished product. 

4. Material damage from prior service. 
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The failure of the Tacoma Narrows Bridge (Paine et al. 1944) is an 
example of improper recognition of loading. This bridge had one of the 
longest spans for a suspension bridge when it was completed in 1940. 

Although it presented a graceful and pleasing profile, its slenderness made 
it aerodynamical ly unstable; it developed severe oscillations in the 
prevailing winds of the Narrows and soon twisted itself apart in a high, 
sustained wind (Figures 1 and 2). The problem arose because of improper 
consideration of the wind conditions and the dynamic response of the slender 
bridge structure to those winds. Wind tunnel tests verified the cause and, 
subsequently, became a consideration in bridge design. 

Although Griffith (1920) developed the basic concept describing the 
brittle fracture of glass in 1920, stability against sudden fracture did not 
become a vital issue until World War II when over 200 all-welded ships 
experienced brittle fracture (National Research Council 1953b) (Figure 3). 

In this case, the loss in fracture ductility with decreasing temperature in 
ferritic steels used for ship plate was an important contributing factor to 
cracking (low fracture toughness) as was a design employing hatches with 
square corners (high stress intensity factor). Full recognition of the 
importance of fracture toughness and the stress-intensity factor in the 
failure of engineering structures did not occur until the late 1940's. 

Another example of instability was the catastrophic failure of two 
de Havilland Comet jet airplanes in the mid-1950s (Bishop 1955). This plane 
was the first passenger plane of this type to be introduced for commercial 
use. Cyclic pressurization of the cabin led to the development and growth 
of small fatigue cracks from rivet holes in window corners causing the 
structure to become unstable and to burst dramatically in mid-air 
(Figure 4). These failures were death blows to the Comet and a severe 
setback to British commercial jet aviation for many years hence. 

Many failures in which the quality of manufacture of the finished 
product was a major factor can be described. One fairly recent case is that 
of the elevated walkways of the Hyatt Regency Hotel in Kansas City (National 
Bureau of Standards 1982). In this case, an on-site change in the method of 
support of the walkway led to tragedy. In July 1981, a crowd was gathered 
on the walkways as well as in the lobby below when the walkways suddenly 
collapsed (Figure 5). Although it was later determined from detailed 
testing that even the original design was inadequate for the imposed load, a 
change had been introduced during construction that doubled the load on the 
box beam bearing surface of the fourth floor walkway by the rods suspended 
from the ceiling, causing the rod to pull through the box beam (Figure 6). 

Material damage in service is also a major source of premature failure. 
The principal cause is fatigue, a process of crack initiation and growth 
arising from cyclic loading. Since crack initiation is greatly accentuated 
by local stress raisers (e.g., notches), material defects (e.g., 
inclusions), and a wide variety of surface conditions and since most 
structures are subjected to cyclic loading, cracking from this cause is 



FIGURE 


1 Tacoma Narrows Bridge showing torsional oscillation one hour before failure 
(Paine et al. 1944). 








7 



FIGURE 3 Brittle fracture in an all-welded ship (courtesy of the Marine 
Board, National Academy of Sciences, Washington, D*C.). 
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FIGURE 5 Walkways at the Kansas Hyatt Regency shortly after the 
collapse (reprinted by permission of the Kansas City 
Times, c 1981). 
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FIGURE 6 



(a) 



Hyatt Regency walkway support components: (a) Hanger rod 

pull-through and (b) end view of box beam (National Bureau 
of Standards 1982) • 
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common* This form of damage can lead to dramatic consequences when a 
critical crack size is reached and unstable fracture ensues. This process 
has already been cited in the case of the Comet crashes. It was also 
responsible for the fairly recent DC-10 accident in Chicago (National 
Transportation Safety Board 1979). In this case, a large fatigue crack in 
an engine mount was initiated by severe (and improper) maintenance 
procedures associated with the removal and installation of replacement 
engines. Engine separation during takeoff resulted when the crack had 
propagated to a critical size. 

Another cause of material damage arises from stress and environmental 
interactions with the structural material employed. A form of such damage 
is known as stress corrosion cracking and has led to a number of 
unanticipated structural failures, one of which was the collapse of the 
Silver Bridge at Point Pleasant, Ohio, in 1967, in which 47 people were 
killed (Bennett and Mindlin 1973). The bridge (Figure 7) was a suspension 
type where the cable was, in fact, a series of connecting eyebars. Over the 
course of time a crack developed in one of the eyes until it reached a 
critical size (about 0.12 in.) for fracture by the normal working stress. 

The crack initiated from some combination of fatigue, stress corrosion, and 
corrosion fatigue. The high hardness of the steel, its low fracture 
toughness, the creviced nature of the geometry, and the impossibility of 
protecting the eyebolt from the weather were all contributing factors to the 
failure. 

Thus, serious structural failures result for many reasons including 
uncertainty in the loading, the presence of unanticipated defects, 
inadequate design, poor material behavior and the nature of the service. 
Other possibilities include lack of proper maintenance and professional 
incompetence. The causes of a structural failure usually are identified 
after the fact but the goal is to recognize the deficiencies before a 
problem occurs. This subject is receiving increasing attention in industry 
and government, and a structural integrity discipline is now emerging. 
Engineering concepts and processes have been developed to prevent structural 
failures by systematically providing for consideration of all known causes 
for failure in a specific structure and by guiding and controlling the 
functions of design, manufacturing, and in-service operation to ensure a low 
risk of structural failure. These concepts, however, have not been widely 
adopted. 

The U.S. Army has experienced unexpected and not very well known 
structural failures. In one case, an anti-tank weapon exploded during a 
demonstration (Hackley 1983). It was designated the light anti-tank weapon 
(LAW), a disposable rocket launcher made from a low-ductility aluminum 
alloy. Although the cause of the accident is unknown, the choice of 
material was believed to be the principal factor in earlier LAW failures. 
Another case of structural failure involves the Army f s high mobility 
multipurpose wheeled vehicle (HUMMER). A major complaint has been its low 
reliability due to engine and drive train, suspension, and weapon mount 
malfunctions or fractures (New York Times 1983) . 

Cases such as these raise questions concerning whether adequate 
engineering could have foreseen and precluded such failures and whether 
adequate design and material selection procedures could have been 






, ■ y' ; 




FIGURE 7 Collapse of Silver Bridge at Point Pleasant, Ohio (Lichtenstein 
1970). 

enforced in some cost-effective way* It is questions such as these that 
occupied the committee's attention, rather than the more technical issues 
such as crack detection methodology or specific material performance* 

The cost of fracture is high. A study of the cost of failures due to 
fracture in the United States has recently been performed by the National 
Bureau of Standards and Battelle Memorial Institute (Reed et al. 1983)* 
The costs were estimated to be very large, $119 billion per year in 1982 
dollars. Costs from the occurrence of fracture and from the prevention 
of fracture were included. Preventive costs include packaging and 
handling, maintenance and repair, quality control and service inspection, 
training, research, and codes and standards development. The study 
estimated that these large costs could be reduced by more than $35 
billion per year through extensive use of available technology directed 
toward more effective and efficient fracture control. Fracture-related 
research could further reduce these costs by about $28 billion per year* 
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Fracture costs to the Department of Defense can be roughly estimated 
to be $6 billion per year. Costs of about $2 billion per year are 
currently reducible through utilization of the best fracture control 
practice. The majority of the currently reducible costs are probably 
associated with the Army since the Air Force and Navy have identifiable 
structural integrity programs and associated fracture-control plans in 
practice. 

Fracture-related accidents contributed to the Department of Defense 
costs. The following table, using 1979 data from safety centers of the 3 
services (Duga et al. 1983), summarizes the accident contribution. 


TABLE 1 Summary of Fracture-Related Accidents in the Army, Navy, and 
Air Force 


Service 

Total No. of 
Accidents 

On-Duty 

Accidents 

No. Due to 
Fracture 

% Due to 
Fracture 

Army 

20,561 

16,040 

900 

4.4 

Navy 

16,048 

12,892 

199 

1.2 

Air Force 

15,015 

7,999 

97 

0.7 


The contribution from the Army is 3 times greater than the sum of the Navy 
and Air Force accidents. 

Based on the above background and on the premise that recently 
developed structural integrity concepts could assure reliable performance if 
a well-defined method was followed, the committee decided to examine 
fracture control programs currently used and to recommend any features of 
such programs that could be utilized by the Army. The committee chose to 
describe its task as follows: 

1. Review structural integrity assurance methodologies currently used 
by government and industry. 

2. Evaluate and document the need for and cost-effectiveness of these 
methodologies. 

3. Assess the merits of requiring use of similar plans by the Army in 
the acquisition of systems in which structural failures could jeopardize 
personnel or mission success. 

This procedure, as well as alternate methods of accomplishing the result, 
were considered. This report addresses these tasks. 
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STRUCTURAL INTEGRITY CONCEPTS 


The engineering concepts and processes that have evolved to systematically 
prevent structural failures are described in this chapter. It should be 
noted, however, that the historical causes of failure for a given class of 
structures are fairly unique to that class of structures. Therefore, the 
details associated with how a specific industry addresses the failures most 
prevalent in their class of structures may be unique to that industry. In 
an attempt to facilitate a better understanding of the terms used to 
describe the concepts and processes of preventing failure, a list of 
definitions is included. Specific note is drawn to the definitions of a 
structural integrity program and of a structural integrity plan. The 
remaining sections of the chapter provide an overview of the engineering 
concepts and processes associated with failure prevention. 


DEFINITIONS 

Structure — A mechanical body (e.g., bridge), composed of one or more 
elements, whose function is to resist forces (loads). The forces may 
develop from contact, pressure, gravitational, inertial, magnetic and 
thermal sources and may result in axial, shear, bending, and torsional 
deformations. The forces could be static (constant), repeated 
(cyclic/fatigue), transient, or sudden (impact). 

Failure — Any change that renders the structure incapable of 
satisfactorily performing its required function. For example, the presence 
of a crack may lead to a loss of force (load) carrying capability and/or 
excessive deformation. 

Structural Integrity — A performance characteristic for a structural 
system. The structural system will perform its function each time that it 
is used for as long as intended without failure. 

Structural Reliability — The probability that a structural system will 
perform its function without failure. Typically, this probability depends 
on the time in service, the number of times that the system is used, or both. 
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Structural Integrity Program — A set of requirements that must be 
considered to ensure structural integrity for a class of structures. The 
requirements normally are established to preclude historical causes of 
failure. 

Structural Integrity Plan — A scheme for implementing the structural 
integrity program for a specific structure. 

Durability — The ability of the structure to resist cracking, corrosion, 
thermal degradation, material changes, wear, delamination, and the effects 
of other time-dependent damage for a specified period of time (or operation). 

Damage Tolerance — The ability of the structure to resist failure due to 
the presence of flaws, cracks, or other damage for a specified period of 
operation. 

Usage — A description of how the structure is used in terms of the 
environment and loading to which the structure is subjected. 

Quality — A description of defects, dimensional variations, and 
discrepancies within a structure that could directly cause or lead to 
failure. 


THE REASON FOR STRUCTURAL INTEGRITY PROGRAMS 

An engineering system is designed to meet specific performance requirements 
and a structural design engineer must balance these overall system 
requirements with the requirement for structural integrity. It normally is 
not possible to meet overall requirements without some degree of structural 
integrity. Unfortunately, the direct ties between overall requirements and 
the structural integrity requirements are not always clear. 

As an engineering system develops, the overall requirements are 
interpreted in terms of trade-offs between budgetary and performance 
requirements. The trade-off studies tend to emphasize those performance 
goals most closely tied to an acceptable demonstration of contractual 
compliance (or lack of subsequent liability). Thus, to ensure structural 
integrity, it is necessary to have clearly defined structural performance 
requirements (goals) that can be demonstrated. The structural performance 
demonstration should be conducted prior to initiating a contractual 
commitment that releases the manufacturer from liability and burdens the 
customer with unwanted structural failure problems. From a cost standpoint, 
it is important that the structural performance requirements be as clearly 
defined as the overall system requirements. 

It is the purpose of structural integrity programs to provide system 
program managers and design engineers with a set of structural performance 
requirements that, if met, should ensure a low risk of structural failure. 
The set of structural performance requirements may dictate preparation of 
specific failure cause and effect evaluations as well as definition of 
overall structural system performance. 
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ELEMENTS OF A STRUCTURAL INTEGRITY PROGRAM 

All structural integrity programs must direct adequate attention to the 
following five elements: 

1. Structural design conditions 

a. Design life 

b. Loads 

c. Environment 

d. Damage assumptions 

2. Materials and processing controls 

a. Selection 

b. Properties 

c. Specifications 

3. Design and analysis controls 

a. Design concepts 

b. Failure modes and effects analysis 
c* Stress analysis 

d. Fatigue analysis 

e. Fracture mechanics analysis 

f. Joining practices 

4. Quality assurance controls 

a. Material /fabrication/processing controls 

b. Inspection 

c. Verification or qualification testing (strength, life, and operation) 

5. In-service controls 

a. Usage monitoring 

b. Maintenance 

c. Inspection 

d. Repair 

These elements include all the factors that are to be considered during 
design, fabrication, and operation to assure a satisfactory level of 
structural integrity during the service life of the structure. 

The structural design conditions provide the basis for sizing the 
structure to protect against failure. They define the expected service 
life, the operating environment (loading, chemical, and thermal history), 
and the uncertainties associated with structural and material quality and 
the operating environment. Materials and processing controls are used to 
select the materials for fabrication, to establish their mechanical 
properties, and to ensure that the materials conform to the requirements of 
material and processing specifications applicable to the given structure. 

The design and analysis controls establish the configuration and sizing of 
the structure such that it can reliably meet its strength and life 
objectives . 
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Quality assurance controls are used to ensure that the as-fabricated 
structure conforms to the design requirements. These controls are 
established to ensure quality throughout the design, fabrication, 
installation, and service life of the structure and include verification (or 
demonstration) testing. 

In-service controls ensure that the structure maintains the required 
level of structural integrity throughout its service life. When necessary, 
the structure is periodically inspected and repaired as required, and 
sometimes the operational history is monitored. 

Historically, two different approaches have evolved for applying 
structural integrity programs (McHenry and Rolfe 1980) • The first is based 
on the use of design and fabrication codes and the second is based on 
performance specifications. The type of structural integrity program is 
frequently dictated by the type of structure that is being designed and 
fabricated. 


STRUCTURAL INTEGRITY PLAN 

Given the definition of the structural integrity requirements for a selected 
structural system, the necessary framework can be developed to ensure that 
these requirements are demonstrated. The structural integrity plan provides 
the mechanism for meeting the requirements. It defines the analytical 
framework and the procedures that will be developed and implemented to 
protect the structure from failure throughout its service life. 

To assure that the structural system maintains a defined level of 
structural integrity (or structural reliability) throughout its service 
life, it is necessary to relate materials, structural configuration 
(geometry), usage, and quality type information to potential modes of 
failure and to life estimates. Mechanics is the science that provides the 
analytical framework for conducting a series of analyses that balance 
structural integrity requirements with structural capability (Figure 8). 
Mechanics is used to calculate relationships between external loadings and 
the internal conditions that define failure. This science integrates the 
influences of material behavior and geometry into the relationships so that 
effects of material changes and geometrical sizing or configurations can be 
analyzed. 

Basic structural analyses deal with bulk calculations; more advanced 
analyses deal with the influence of cracks. The basic bulk-material type 
analyses are concerned with precluding the simpler modes of failure due to 
overloads, excessive deformation, buckling, etc. 

Most structural integrity analyses use deterministic values to describe 
the relationships between structural geometry, materials of construction, 
quality of workmanship, and operational usage assumptions (Figure 8). The 
deterministic values are established as worst-case estimates so that the 
likelihood of fracture is remote (but undefined). 
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FIGURE 8 Informational elements that must be modeled in a structural 
integrity analysis. 


Structural reliability calculations normally are conducted utilizing 
statistical descriptions of each of the four informational elements shown in 
Figure 8 to estimate the probability for different types of failure as a 
function of time in service. The structural reliability calculations 
utilize the same analytical framework employed for the deterministic 
descriptions of the input. Typically, sensitivity studies are conducted to 
establish the importance of the deterministic inputs to the final estimate 
of structural integrity. 
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The analytical framework integrating the informational elements shown in 
Figure 8 is supported by empirical information based on test results and 
operational experience* Quantification of the informational elements can be 
both difficult and inexact. The incorporation of new concepts (whether 
associated with materials, configurations, operations, or quality assurance) 
always leads to inaccuracies that decrease the confidence in structural 
reliability* For structural applications, materials behavior is quantified 
through the use of the mechanical properties (yield strength, elastic 
modulus, crack growth resistance, etc*)* Configurations are evaluated based 
on structural efficiency factors that measure load carrying capability, load 
transferred, damage tolerance, stiffness, etc. Operational usage is defined 
by load and environmental spectra that are characterized with a set of 
extreme conditions or with a sequence of ordered load and environmental 
events. Quality assurance is quantified based on surface characterizations, 
nondestructive evaluations, destructive testing, and other procedures that 
are difficult to quantify. For additional discussion of the technologies 
that support structural integrity plans see Pellini (1976) and Gallagher and 
Crooker (1979). 

Prior to applying a structural integrity plan, it is necessary to fully 
ascertain the potential causes of failure and to define the importance of 
each of the elements shown in Figure 8 to the different types of failure. 
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EXAMPLES OF STRUCTURAL INTEGRITY PROGRAMS 


This chapter describes a number of structural integrity programs that are 
currently employed to ensure the safety and reliability of equipment 
designed, sold, procured, regulated, or used by government and commercial 
organizations. Each program has evolved to define and emphasize design, 
manufacturing, and in-service elements that require controls if one 
wishes to preclude failures of a type historically experienced by the 
class of structures covered by the program. Some programs described are 
unique to a specific organization; this is particularly the case for 
commercial organizations that design, manufacture, sell, and service 
equipment. Other programs have become industry standards; these 
programs are typically imposed on industry by a government organization 
that regulates, procures, uses, and/or maintains the equipment. All 
programs examined have improved the safety and reliability of the 
equipment in the field because of profit stimulation, product reputation, 
or government requirements. 


STRUCTURAL INTEGRITY ASSURANCE PROGRAM IN THE 
COMMERCIAL NUCLEAR POWER INDUSTRY* 

Purpose 

The primary objective of the structural integrity program in the nuclear 
power industry is the assurance of plant safety. Structural failures in 
equipment and structures important to plant safety could lead to a 
malfunction of that equipment and, in severe cases, could pose a threat 
to the health and safety of plant workers and/or the general public. 
Other important considerations reflect economic factors (repair of 
structural failures in nuclear power plants involve higher than normal 
costs because of radiation concerns and extremely high plant outage and 
replacement power costs) and visibility concerns (there is a high level 

*Based on a May 1983 presentation to the committee by Dr. Sumio Yukawa, 
Turbine Technology Laboratory, General Electric Company, Schenectady, 
New York. 
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of public and media interest in any problem at a nuclear power plant as 
evidenced by the attention given the 1979 Three Mile Island accident). 
Even a minor incident can receive much publicity. These latter 
considerations, however, are secondary to the primary focus of plant 
safety. 

Description 

In order to meet its objective, the nuclear power industry has an 
intensive and broad-reaching structural integrity assurance program that 
covers virtually all equipment and structures in a power plant. The 
program is implemented through industry codes and standards. Their use 
is mandated by the federal laws and regulations governing the licensing 
and operation of commercial nuclear power plants. (By and large, 
overseas operators have adopted the U.S. codes and standards or their 
equivalent.) The major documents that embody the structural integrity 
assurance program for nuclear power plants are: 

1. American Society of Mechanical Engineers (ASME) Boiler and 
Pressure Vessel Code, Section III - Rules for Construction of Nuclear 
Power Plant Components; 

2. ASME Boiler and Pressure Vessel Code, Section XI, Rules for 
In-Service Inspection of Nuclear Power Plant Components; and 

3. Institute of Electrical and Electronics Engineers (IEEE) 344, 
Recommended Practices for Seismic Qualification of Equipment for Nuclear 
Power Generating Stations. 

The program includes: 

1. Classification of equipment with respect to its importance to 
plant safety. 

2. Definition of structural design conditions for the plant lifetime 
(usually 40 years). Design conditions include normal operational loads, 
seismic loads, and special loads resulting from certain postulated 
"design basis accidents" at the plant. Special seismic testing 
requirements are also specified in IEEE 344 for certain classes of 
equipment which, by their nature, are not amenable to analysis. 

3. Material selection. ASME Section III specifies allowable 
materials for various classes of equipment as well as the design strength 
and toughness properties for each. Acceptable welding procedures and 
process controls also are specified by code. 

4. Design analysis rules. ASME Section III imposes various factors 
of safety for specific combinations of equipment classifications and 
loading conditions. The design rules also provide for materials fatigue 
and brittle fracture consideration. 


25 


5. Quality assurance rules that are imposed, to ensure that the 
above requirements will be universally implemented. Extensive pedigrees 
and paperwork certifying that materials and process requirements have 
been met accompany each heat of material and each fabricated component. 
Various levels of nondestructive examination are imposed during 
construction with associated acceptance standards for flaws or defects. 

6. In-service controls. ASME Section XI specifies these controls 
which include an extensive in-service nondestructive examination program, 
periodic pressure testing of reactor pressure boundary components, and 
periodic functional testing of essential pumps and valves. As in design 
and construction, the level and extent of in-service controls also are 
geared to the classification of the equipment with respect to its 
importance to plant safety. Acceptance standards for in-service 
inspections are based on fracture mechanics flaw tolerance considerations 
with the criteria being that there be no loss in the structural safety 
margin for the original design basis for the component. 

Benefits 


The overriding result of the nuclear power industry's structural 
integrity assurance program is that the basic safety objective has been 
met. There has never been a plant structural failure that has had 
significant public health or safety consequences. Any structural failure 
or material cracking problems have been detected early, through 
in-service monitoring, and corrective actions have been implemented long 
before the problems had any impact on structural safety margins. 


FRACTURE CONTROL IN THE POWER GENERATION INDUSTRY 
(LARGE ROTATING EQUIPMENT)* 

Purpose 

Power generation equipment in the United States is manufactured by 
private industry whose major goal is profit; therefore, the ultimate 
purpose of a structural integrity program is an economic one. Specific 
goals are to reduce structural component failures that may cause serious 
equipment damage and safety hazards, to decrease maintenance 
requirements, and to increase the efficiency. These considerations can 
all be influenced by a structural integrity program that attempts to 
reduce structural failures and all of these issues are related to 
economics. 

Description 

The power generation industry has long been aware of the problems 
associated with the assurance of structural integrity in large rotating 

*Based on a May 1983 presentation to the committee by Dr. John Landes, 
Westinghouse Research and Development Center, Pittsburgh, Pennsylvania. 
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equipment. A catastrophic brittle fracture can suddenly release millions 
of foot-pounds of stored energy and cause damage equivalent to the 
detonation of high explosives. Work was begun in the late 1940s to try 
to understand the factors controlling flaw growth and fracture of metals 
(Robinson 1944). A series of catastrophic failures of large, medium 
strength, turbine and generator rotor forgings in the mid-1950s greatly 
accelerated this work (Thum 1956). Much of the work in the 1950s 
employed spin burst tests (Sankey 1960, Winne and Wundt 1958) of large 
model rotors with sharp machined notches in the bore to evaluate 
susceptibility to brittle fracture. With the development of linear 
elastic fracture mechanics (LEFM) approaches in the late 1950s and early 
1960s, fatigue precracked specimens were substituted for notched 
specimens (Wessel 1960, Yukawa and McMullen 1961). The concept of LEFM 
K iq fracture toughness was developed and a more convenient laboratory 
specimen was substituted for the spin burst test. The power generation 
industry has continued to use fracture mechanics concepts for structural 
integrity procedures, and these concepts have evolved to consider cyclic 
loading, adverse environments, and plasticity effects in addition to 
brittle fracture. 

The structural integrity plans implemented by the various 
manufacturers of large rotating equipment are not uniform within the 
industry because there is no industry regulatory agency. These plans are 
often proprietary and the major components of a single power plant can be 
manufactured by different divisions of a large corporation using 
different methods for structural integrity assurance. 

Usually the main burden of developing and implementing a structural 
integrity plan lies with the designers of the equipment. They must be 
aware of all elements in a structural integrity plan and make sure that 
these elements are included in the design. Very often the designers will 
rely on support groups to cover the specific elements for ensuring 
structural integrity. For example, a materials group may recommend an 
optimum material for an application, a nondestructive inspection group 
may determine the level of quality of materials and manufactured parts, 
and an analysis group may provide information on loads and stresses of a 
component during usage. Nevertheless, it is the equipment designer who 
must ensure that all needed elements are included. Fortunately, most new 
designs are based on previous ones and the designers of new systems need 
not completely develop new structural integrity plans since information 
relating to the reliability of earlier designs is used to develop 
procedures that become part of a standard design practice. 

Traditionally, the designer has been largely responsible for ensuring 
that a structural integrity plan was incorporated in the design. With 
the increasing importance of structural integrity, however, new methods 
are being developed to assist the designer in ensuring that the 
structural integrity plan is followed. One of these methods is design 
review in which experts on all elements of a structural integrity 
analysis review a design to make sure that nothing is missing in the 
plan. This is especially important with new designs to ensure that the 
latest technological advances are included in the design and integrity 
plan. 
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Equipment integrity also is reviewed once the equipment is placed in 
service. Unfortunately, deficiencies in the structural integrity plan 
are sometimes discovered at this stage and may require immediate design 
modifications. These modifications can involve costly field repairs and 
major revamping of manufacturing procedures. 

Benefits 


The application of a structural integrity plan to ensure the reliability 
of large rotating equipment produces economic benefits for both the 
equipment manufacturer and the user of the equipment. 

The manufacturer of the equipment is a private corporation and has 
profit as an ultimate goal. Failure of a piece of equipment can cause 
direct loss of profit as a result of obligations, lawsuits for property 
damage, and compensation required for loss of life or serious injury. 
Structural failure also can result in an indirect loss of profit in that 
poor performance of equipment, safety problems, inefficient operation and 
high maintenance costs can create a poor image for a corporation and 
severely affect sales. 

The customer who purchases and uses the equipment also has economic 
concerns. Poor performance and structural failure can adversely affect 
the efficiency of the customer's operation. Unplanned equipment outages 
result not only in unplanned maintenance costs but also in shutdown of a 
power generating unit and, thus, revenue that would have been generated 
by that unit is lost for the shutdown period (easily in excess of $1 
million a week for a power unit in excess of 100 MW). 


FATIGUE ANALYSIS PROGRAM FOR GROUND VEHICLE COMPONENTS* 

Purpose 

The Ford Motor Company has developed a computerized fatigue analysis 
supervisory program (FATSUP) . It is specifically tailored to the needs 
of a large industrial engineering organization and provides the Ford 
engineering staff with the most recent advances in structural fatigue 
methodologies. 

Description 

The ground vehicle industry uses fatigue analysis in the following areas: 

1. Initial sizing of prototype components, 

2. Design of production components, and 

3. Revision of production components. 


*Based on a May 1983 presentation to the committee by Dr. R. W. Landgraf, 
Ford Motor Company, Detroit, Michigan. 
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In initial sizing, the selection of a design load level by an engineer 
determines estimated material, size, and durability requirements of the 
components. This initial design information is based upon past history, 
handbooks, and supplier material and durability statistics. 


Prototypes are built and tested both in the laboratory and on the 
proving grounds to estimate design loads for production components. 
Variations in these tests result in the conduct of fatigue life 
computations. 

The design of production components is continuously revised in order 
to decrease weight (increase mileage rating) or make material changes as 
a result of differences in proving ground assumptions and actual customer 
experience. Computations for fatigue damage are made to determine the 
effects on the modified component. 

The Ford design and analysis groups have available, through FATSUP, a 
versatile computer program that can describe and manipulate the variety 
of load, stress analysis, and material property data required to perform 
the various fatigue analyses described above. In reviewing the basic 
elements of a structural integrity program, FATSUP incorporates into its 
data files the information from all five major program elements 
identified in Chapter 2 that are pertinent to designing components for 
ground vehicles. The program is not really directed at the quality 
control aspects or the maintenance, inspection, and repair aspects. 

Benefits 


In this example of a representative ground vehicle structural integrity 
program, the focus is on a single failure mode, fatigue, known to be of 
special importance to the automotive industry. The result is a package 
of interactive computer program modules that enable the designer to 
formulate and solve a wide variety of ground vehicle problems using 
state-of-the-art approaches to fatigue analysis. The approach reflects a 
philosophy on the part of the ground vehicle industry to design out 
potential fatigue problems before the prototype goes into production so 
as to achieve recognition as producers of reliable, low maintenance 
products . 


ASSURING STRUCTURAL INTEGRITY OF OIL PIPELINES* 

A structural integrity plan has been successfully applied to establish 
allowable-flaw-size limitations in pipeline girth welds. It was 
developed in 1976 when the National Bureau of Standards (NBS) assisted 
the U.S. Department of Transportation (DOT) (Reed et al. 1979) in the 


*Based on a May 1983 presentation to the committee by Dr. Harry McHenry, 
National Bureau of Standards, Boulder, Colorado. 
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evaluation of a petition for a waiver of American Petroleum Institute 
(API) weld quality standards for certain girth welds in the Trans-Alaska 
Pipeline System (TAPS). 

Purpose 

Federal safety regulations for pipelines stipulate that the acceptability 
of girth welds must be determined in accordance with API weld quality 
requirements. Allowable flaw sizes for each of the characteristic defect 
types are set forth in API 1104 on the basis of workmanship consider- 
ations (i.e., flaw size limits are based on quality levels that can 
reasonably be expected from a qualified welder using satisfactory 
materials, equipment, and procedures). In addition, federal regulations 
stipulate that all arc burns must be repaired. The quality requirements 
are the same for all pipelines regardless of pipe size, strength and 
toughness of pipe and girth welds, or pipeline operating conditions. 

The waiver request proposed alternative weld quality standards based 
on a f itness-for-service assessment done in accordance with draft British 
Standards Institution rules (British Standards Institution 1976). This 
investigation was subsequently followed by a DOT decision that permitted 
limited use of the alternative standards and set an important legal 
precedent: n Fracture mechanics analysis is acceptable as a basis for 

granting exemptions from existing standards in appropriate circum- 
stances .... 11 A subsequent audit of a statistical sample of TAPS girth 
weld radiographs (1500 welds) indicated that 7.9 percent of the girth 
welds sampled did not meet DOT weld quality standards. The alternative 
standards and the legal precedent provided the basis for deciding that 
the weld quality was acceptable, thereby avoiding a potential delay in 
pipeline start-up. Additionally, the large costs associated with field 
repair of girth welds were avoided. 

Alternative allowable flaw sizes for girth welds in a specific 
pipeline were calculated on the basis of fracture mechanics analyses in 
accordance with requirements set forth by the Office of Pipeline Safety 
Operations (OPSO) of DOT. 

Description 


Critical flaw sizes were calculated using four distinct fracture 
mechanics analysis methods and the appropriate maximum credible stress 
and material property information. The fracture mechanics models were: 

(1) the critical crack opening displacement (COD) method (Knott 1973), 

(2) the draft British rules, (3) the plastic instability method, and 
(4) a semi-empirical method developed on the basis of pipe rupture 
tests. The material property data needed included fracture toughness, 
tensile properties, fatigue crack growth rate, and the stress corrosion 
threshold. Minimum material properties over the temperature range 
represented by pipeline operating conditions were used. 

Alternate allowable flaw size curves were calculated using the 
applicable fracture mechanics models, material property data, and 
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pipeline operating stresses for each of four types of flaw: blunt 

(nonplanar) weld flaws such as porosity and slag, sharp flaws such as 
incomplete penetration and lack of fusion, arc bums in the weld or heat 
affected zone, and arc burns in the base metal. The calculated flaw 
sizes were reduced in magnitude by the safety factors specified in the 
0PS0 requirements. The results were plotted as alternative allowable 
flaw size curves with flaw depth versus flaw length (Figure 9). 

Worst-case operating conditions were used to assign stress values. 
Girth weld flaws are typically oriented circumferentially and, 
consequently, axial stresses (including pressure and thermal cycles and 
earthquake loadings during 30-year pipeline lifetime) were used in the 
fracture mechanics analysis. Arc burns were typically spots or axially 
aligned drags and flaw growth would be caused by the hoop stresses 
(including hydrotests, pressure surges, and on-off pressure cycles). 

Since all flaws were considered as surface cracks, the principal 
differences in the four types were orientation, location, and applicable 
safety factors. Flaw orientation determined whether the applicable 
stresses were axial or hoop. Flaw location was used to establish the 
applicable minimum fracture toughness value. The applicable safety 
factors include a factor of two on length and depth for all flaws plus an 
additional factor of two on estimated depth of planar flaws. 

Benefits 


There are strong economic incentives to apply a structural integrity plan 
to field welds of large diameter pipelines. The majority of girth weld 
flaws, whose size exceeds the API 1104 welding workmanship standards, are 
blunt flaws. Application of a structural integrity plan (using fracture 
mechanics assessment) permits larger blunt flaws to remain, thus reducing 
the frequency of very expensive repair welding in the field. Addition- 
ally, the API have proposed a generic pipeline structural integrity plan 
for addition to DOT federal regulations. In support of this, the 
National Bureau of Standards has been developing fracture mechanics and 
nondestructive inspection for a generic pipeline structural integrity 
plan and for possible Alaska gas pipelines. 


STRUCTURAL INTEGRITY PROGRAM FOR AIRFRAMES* 

Purpose 

Another example of a structural integrity program is the U.S. Air Force's 
Aircraft Structural Integrity Program (ASIP) described in Military 
Standard 1530A. This document defines the overall requirements necessary 
to achieve structural integrity of USAF airplanes and specifies 
acceptance methods of contractor compliance. The standard is used by 


*Based on a July 1983 presentation to the committee by Dr. Frank Adams, 
Air Force Wright Aeronautical Laboratory, Wright-Patterson Air Force 
Base, Ohio. 
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FIGURE 9 Alternative allowable flaw size curve for sharp (planar) flaws 
in Trans-Alaska Pipeline System girth welds (McHenry 1979). 
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contractors in developing an airframe for a particular weapon or support 
system and by government personnel in managing the development, 
production, and operational support of a particular airplane system 
throughout its life cycle. It is directly applicable to manned power 
driven aircraft having fixed or adjustable fixed wings and to those 
portions of manned helicopters that have similar structural 
characteristics. Helicopter transmission systems and rotors and other 
dynamic machinery including engines are not covered by this standard. 

Description 

Military Standard 1530A was developed in the early 1970s after the 
catastrophic crash of an F-lll aircraft that had only 100 hours of flight 
service. The cause of the accident was an undetected flaw in the wing 
pivot fitting that resulted in the loss of the wing during flight. 

Prior to 1970 the Air Force used a "safe-life" approach to structural 
design to ensure safety and durability. In general, the fatigue life of 
the structure was determined through testing of materials, components, 
and full-scale airframes and a safety factor of four applied to reduce 
the probability of failure to an acceptable value. This approach did not 
explicitly take into account the possibility of infrequently occurring 
flaws due to material defects and manufacturing processes. The F-lll 
crash stimulated the Air Force to adopt a new design philosophy. The 
basic assumptions underlying this new approach are that flaws are present 
in new structures and that structures can be designed such that cracks 
can grow from these flaws for a specified period of unrepaired service 
without structural failure occurring. This approach is generally 
referred to as "damage-tolerant" design. 

A very important feature of the Air Force* s new approach, which can 
be applied to structural design in an economic way, is that damage 
tolerance (avoidance of catastrophic failure in flight) and durability 
are decoupled. This was not the case with the safe-life approach. 

The current Air Force structural integrity program is firmly embedded 
in Air Force regulations. USAF Regulation 80-13 instructs the system 
program offices (SPOs), which have responsibility for developing new 
aircraft weapon systems, to comply with Military-Standard 1530A, USAF 
Aircraft Structural Integrity Program. This program has five tasks that 
cover an airframe from preliminary design to retirement. Detailed 
requirements related to damage tolerance, durability structural testing, 
sonic fatigue, etc., are provided in a set of military specifications. 

The applicable regulations are outlined in Figure 10 and the five tasks 
in the ASIP, in Figure 11. 

Task I of the USAF ASIP deals with design information. The objective 
is to develop criteria that must be applied during design so that the 
specific requirements are met. The first step is the development by the 
contractor of an ASIP Master Plan for any new aircraft system. This plan 
includes: 
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FIGURE 10 USAF Aircraft structural integrity program. 
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1. Time-phased scheduling, 

2. Task integration, 

3. Unique features, 

4. Anticipated problems, and 

5. Impact of delays — recovery plans. 

It is updated annually or when important changes occur and must be 
approved by the Air Force. The contractor also must establish structural 
design criteria. These must be in concert with the applicable military 
specifications. 

Task I also deals with the development of damage-tolerance and 
durability control plans. In these plans, fracture-critical and 
durability-critical parts are identified. Drawings showing critical 
locations are developed. Also documented are the basic fracture data to 
be used, quality control procedures, inspection techniques, test 
procedures, material processing specifications, and joining methods. All 
of the subtasks in Task I are performed taking into account the design 
service life and design usage specified by the Air Force. 

Task II deals with design analysis and developmental tests. Material 
and joint allowables are developed. Load analyses are performed to 
obtain the design load spectra (load histories). Thermal and chemical 
environments are considered. This task also includes the stress analysis 
work. In addition, fracture mechanics life analyses are required for 
each structure on the fracture critical parts list. Life analyses are 
performed on durability critical parts. Other analyses include sonic 
fatigue, vibration, flutter, nuclear weapon, and non-nuclear weapon 
effects. Developmental testing to verify all of these analyses is 
performed under Task II. 

Task III involves full-scale testing of the structure. This includes 
static strength tests of the full airframe and/or selected components. 
Cyclic durability (fatigue) tests also are performed. Damage tolerance 
testing is accomplished on structures in which flaws have been introduced 
at critical locations. Sonic fatigue, vibration and flutter testing are 
performed when appropriate. The basic objective of all full-scale 
testing is to verify analyses performed during Task II. This is markedly 
different from what occurred under the pre-1970 safe-life approach which 
used full-scale testing to determine the structural life. 

Tasks IV and V involve "force management" which is the term the USAF 
employs to refer to the assurance of structural integrity after the 
aircraft is operational. Task IV is performed by the contractor while 
Task V is accomplished by the Air Force. 

In Task IV the contractor is required to develop a "force structural 
maintenance plan." This is the "owners manual" and provides plans for 
the specific actions needed during the service life. Cost factors also 
are developed during this task. Another part of Task IV is the 
development of the plans and data package required to perform a 
"load/environment spectra survey." This involves instrumenting a portion 
of the fleet to measure actual load histories. These data are later used 
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to update life analyses performed using the design load histories. Task 
IV also includes the development of an individual airplane tracking 
program. Most of the current operations aircraft in the USAF fleet are 
tracked to determine individual differences in usage that may affect 
structural life. Simple instrumentation such as counting accelerometers 
or pilot/engineer log data are used for this purpose. 

Task V covers the force management activities accomplished by the Air 
Force. This involves implementation of the force structural maintenance 
plan. Information from the loads /environment spectra survey is used to 
update this plan. Data from the individual airplane tracking program are 
employed to modify maintenance and inspection schedules to account for 
individual usage. This task also involves the development and control of 
all maintenance records. 

Benefits 


The basic objectives of the USAF ASIP are being met. Structural failures 
due to fracture are involved in less than 1 percent of the total 
accidents reported by the Air Force (see Table 1). The ASIP pays 
particular attention to obtaining a specified level of damage tolerance 
in flight-critical structures in order to ensure safety. This is of 
significant importance in modern high performance aircraft where high 
strength materials are often required. The cradle-to-grave application 
of the ASIP provides opportunities to lower life-cycle costs by 
preventing structural integrity problems rather than by "fixing 11 through 
redesign or repair. 


STRUCTURAL INTEGRITY PROGRAM FOR AIRCRAFT GAS TURBINE ENGINES* 

Purpose 

The purpose of the current Air Force structural integrity program for 
aircraft turbine engine structures is to improve the reliability (for 
increased readiness) of new designs at lower cost and to minimize the 
potential for catastrophic failures (Cowie 1975 and 1983, Tiffany and 
Cowie 1978). This program has evolved over the past 15 years to the 
point where structural performance specifications were incorporated into 
the 1973 revision of Military Specification E-5007 (a tri-services 
specification covering aircraft engines) and a formal Engine Structural 
Integrity Program (ENSIP) was written and completed in 1978. In early 
1983, a mil-prime standard was sent to the specifications office for 
publishing (Mil-Prime Standard on Turbine Engine Structural Integrity 
Program) and contains all requirements published in 1978. 

Traditional approaches to turbine engine design emphasized system 
performance criteria (e.g., high thrust to weight ratios) at the expense 
of structural performance criteria (e.g. , high resistance to damage from 
thermal-mechanical loadings). Early procurement development programs 

*Based in part on a May 1983 presentation to the committee by 
Mr. Anton Coles, Aircraft Engine Business Group, General Electric Co., 
Cincinnati, Ohio. 
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relied heavily on n build 'em and bust 'em" concepts that emphasized the 
repair of structural problems identified during system performance 
evaluations. Two major reasons for the lack of any in-depth structural 
attention were the limited understanding of the usage experienced by the 
structural members while the engine was operating and the absence of 
realistic structural qualification testing. 

Description 


Like the Air Force's ASIP, the ENSIP is time-phased to control structural 
integrity actions from preliminary design through to system retirement. 
The five ENSIP tasks are outlined in Figure 12. 

Within Task I, the structural design conditions are established and 
the structural integrity plan is prepared. Cowie (private communication 
between W. D. Cowie, Wright-Patterson Air Force Base, Ohio and 
J. P. Gallagher, University of Dayton Research Institute, Ohio, 

September 27, 1983) considers this task to be the most important since 
within this task, usage is defined, design criteria are developed, and 
life requirements are specified. Under Task II, general design 
conditions for the structure are used to develop the specific duty cycle 
(usage conditions) for individual structural components. Detailed design 
and analysis also are conducted on individual components and the 
materials of construction are chosen, quantified, and controlled. 

During Tasks III and IV, quality assurance testing is conducted on 
the engine structure and its major components. One distinguishing 
feature of the ENSIP is that it verifies design and analysis assumptions 
and demonstrates that the structure has met its structural performance 
objectives. A thorough evaluation of any design deficiencies also is 
conducted. One important aspect associated with the demonstration tests 
should be noted: production decisions are directly tied to the schedule 

and success of the full-scale demonstration tests. For example, one 
lifetime of testing is required on a designated full-scale engine 
demonstration prior to production release. The tests conducted under 
Tasks III and IV provide information for iterating the design and 
updating the structural integrity plan to include the anticipated impact 
of real or potential problems on in-service operation. 

Task V covers the implementation of the structural integrity plan 
during the production and operational life of the engine. Task V 
subtasks include the final output of ENSIP which are production quality 
assurance controls on material, fabrication, processing and inspections 
and in-service controls on usage monitoring and on in-service 
inspections, repairs, and structural maintenance. 

Benefits 


As the ENSIP has been evolving, benefits to the development and 
procurement of more reliable engines have been noted. Specifically, mean 
time between failures has been noted to increase in the operational 
environment and major failures have been decreasing. It should be noted 
that the early version of the ENSIP incorporated into the 1973 version of 
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Military Specification E-5007 was applied both by the Army (Helicopter 
Command, St. Louis) and by the Navy (Naval Air Systems Command) during 
the development programs for the T700 and F404 engines, respectively. 
These engines are considered by Cowie (private communication between W. 
D. Cowie, Wright-Patterson Air Force Base, Ohio and J. P. Gallagher, 
University of Dayton Research Institute, Ohio, September 27, 1983) to be 
excellent low maintenance examples of the successful application of the 
engine structural integrity program. 


U.S. NAVY STRUCTURAL INTEGRITY PROGRAM FOR AIRCRAFT* 

Purpose 

The U.S. Navy structural integrity program is intended to identify for 
both the Navy and its contractors the requirements to be fulfilled to 
achieve structural integrity. Some specific goals of this structural 
integrity program are: 

1. To establish, evaluate, and substantiate the structural integrity 
of the aircraft. 

2. To provide assessment of in-service integrity. 

3. To provide a basis for logistics and force planning relative to 
maintenance, rotation, and phase-out. 

4. To develop methods for improving design of future airplanes. 

Ultimately, the structural integrity program must minimize the incidence 
of catastrophic failure, improve the reliability and readiness of the 
fleet aircraft, minimize weight penalties, and hold the line on costs. 

Description 

The U.S. Navy's aircraft structural integrity program is fundamentally 
based on fatigue (safe life) philosophy supplemented by durability and 
damage-tolerance requirements. Navy policy requires design for a long 
life using a severe load spectrum. The severe load spectrum provides for 
the "worst-case aircraft" and is tailored to include loads that are 
critical for all major sections of the aircraft. The combination of 
fatigue, durability and damage-tolerance (crack growth), severe loads, 
and long life requirements provides a grueling test for design and 
structural integrity substantiation. 

To ensure that the design and manufacturing processes produce a 
durable and damage-tolerant structure, basic fatigue and fracture control 
requirements are included in the aircraft detail design specification. 
These requirements will include criteria for identification of critical 

*Based on a July 1983 presentation to the committee by Dr. Shih L. Huang 
and Mr. Allan H. Johnson, Naval Air Development Command, Warminster, 
Pennsylvania. 
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components, crack growth requirements for these components, and the 
development of a fatigue and fracture control plan that, when implemented, 
will ensure the development of a safe and reliable aircraft structure. For 
the most recent fighter aircraft (F-18), the detailed analysis, test, 
manufacturing, and materials processing requirements and controls were 
delineated in a fatigue and fracture control plan. This plan was prepared 
by the contractor with review and approval by Navy officials. 

For the F-18, long life meant 20 years for the average aircraft. This 
equated to the following in terms of design spectrum lifetime: flight 

hours, 6000; ground-air-ground cycles, 3000; field taxi runs, 3500; catapult 
launchings, 2000; landings, including field, 3000; field carrier landing 
passes, 3000; arrested, 2000; and carrier touch and go, 300. 

The severe design spectrum has two important facets. The first is the 
frequency of maneuvering load factor experiences. The design spectrum is 
tailored to reflect the expected usage for the worst-case aircraft. Second, 
all load factor exceedances are assumed to take place at "points in the sky" 
critical for major structural components. 

The F-18 fatigue and fracture control program resulted in 50 structural 
parts being classified as fracture critical and 210 parts, as maintenance 
critical. Fracture critical parts involved safety of flight whereas 
maintenance-critical parts related to significant operational or cost 
impact. All critical components were subjected to crack growth as well as 
total life requirements. 

The critical component crack growth analysis was required to show one 
design spectrum lifetime from a 0.010 in. initial flaw to critical crack 
size in addition to two lifetimes prior to crack initiation. Design 
spectrum hours from detectable flaw to component failure and maximum initial 
flaw size that would still result in one design spectrum lifetime, also were 
determined. 

The Navy aircraft structural integrity substantiation requirements place 
heavy emphasis on full-scale article and component test results. A 
full-scale airframe is subjected to repeated loads until it has demonstrated 
an endurance of at least two design spectrum lifetimes. Cracks found in 
structural components during these tests are treated as failures requiring 
redesign and retest. To ensure that necessary structural changes are 
identified and incorporated with minimum cost and risk, these tests are 
accomplished as early in the program as possible. 

Finally, to provide a means of scheduling timely actions to detect 
structural problems, and to facilitate force management decisions, a fatigue 
life tracking program has been established for individual fleet aircraft. 
This program provides the status of the individual aircraft fatigue life 
expended for fleet aircraft determined by comparing actual usage to the full 
scale test results. This requires on-board monitoring equipment. The older 
fleet aircraft generally were equipped with counting accelerometers for this 
purpose whereas the newer aircraft probably will be equipped with 
microprocessors . 
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Benefits 


The benefits of a structural integrity program can be ranked in various 
categories* Certainly safety is an important consideration, perhaps ranking 
higher than all others* The reliability and need for maintenance affect the 
readiness of the fleet aircraft economics; visibility and political factors 
are also important in developing hardware for government procurement* The 
structural integrity program implemented by the U.S* Navy for aircraft has 
resulted in remarkably improved reliability and performance. 


CONCLUDING COMMENTS 

Several additional structural integrity programs were reviewed by the 
committee; these programs were associated with the NASA space shuttle 
program (McHenry and Rolfe 1980), the NASA Titan III program (May 1983 
presentation to the committee by Mr. Robert Heymans, Martin Marietta 
Corporation, Denver, Colorado), and the Army helicopter program (Gustafson 
1977 and Hoffrichter and McCracken 1978). The committee also reviewed both 
the Air Force airframe requirements (July 1983 presentation to the committee 
by Dr. Frank Adams , Air Force Wright Aeronautical Laboratory, 
Wright-Patterson Air Force Base, Ohio) and the industrial implementation of 
these requirements (May 1983 presentation to the committee by 
Mr. Richard Circle, Lockheed Georgia Company, Marietta, Georgia). These 
reviews further illustrated various approaches to developing failure 
prevention programs for given types of structures. 

The process of developing and implementing a successful structural 
integrity program that incorporates the use of new or advanced technology 
requires a substantial commitment by company and project management, and 
project engineering organizations. This commitment normally comes as a 
result of contractual obligations or economic pressures. Organizational 
structure becomes important and involves project management that provides 
programmatics, cost, schedules, basic requirements, and customer liaison. 
Engineering provides staffing, quality of engineering, engineering tools, 
and state-of-the-art methodology to the project management relative to 
design choices. 

To ensure that adequate consideration is given during design to 
structural integrity, both internal and external design reviews are 
conducted. The internal reviews involve teams of company structural and 
materials engineering specialists who deal with problem solving, analysis 
procedures, and design approaches for preventing failures. Typically, the 
internal reviews extend beyond the project engineering team with the primary 
design responsibility. 

When the industrial organization is contractually liable for 
implementing a customer-required structural integrity program, the customer 
typically conducts independent reviews of the design. These reviews can 
involve an approval cycle for the structural integrity plan and its 
supporting technology as well as in-depth evaluations (or audits) of the 
design capability, qualification test failures, quality control procedures, 
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and any other facet that the customer believes essential to the success of 
the design and his product. 

As a final note to this chapter some comments by Robert Heymans of 
Martin Marietta Corporation (presentation to the committee, May 18, 1983) 
are instructive. Although personal, they reflect one individuals 
characterization of an on-going and successful structural integrity program 
as : 


We don't do a good job of rewarding good design; over- 
engineering is seldom recognized. 

Fracture control plans are probably imposed on an 
organization by the customer. It's overseeing, demeaning, 
and is a great inconvenience but imposes beneficial 
discipline. 

The structural integrity system is expensive, frustrating, 
time consuming, stifling, demotivating, dehumanizing, but it 
works. 
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STRUCTURAL INTEGRITY ISSUES IN THE ARMY 


INTRODUCTION 

This chapter presents several case studies of Army systems that illustrate 
how structural integrity was or was not implemented in the development 
process. The use of a structural integrity plan reflects an overt decision 
by the program manager that was essential to the development of the system. 
When a structural integrity plan was not used, it was simply taken for 
granted, not intentionally ignored. The cases considered are examples. No 
attempt was made to develop or assess the full scope of recent Army 
structural failures. 


CASE STUDY: THE M72 LIGHT ANTITANK WEAPON (LAW) 

History 

The M72 light antitank weapon (LAW) system was developed in the early 1960s 
for Army and Marine Corps use. The system consists of a self-contained 
lightweight shoulder-fired launcher and a high explosive antitank rocket. 
Major components of the launcher and rocket are identified in Figures 13 and 
14. 


From very early in its history, the LAW has experienced a series of 
failure problems in the rocket closure and motor body that resulted in 
failure to perform its mission and, in some cases, injury to personnel. In 
the early 1970s, failures occurred in the rocket closure. Figure 15 
illustrates the basic nature of the failures. This early problem was 
corrected by strengthening the closure with a fiberglass overwrap. A second 
series of failures occurred in the mid-1970s. In this case, the failures 
were in the rocket motor body. A second "fix" of fiberglass wrapping of the 
highly stressed and flaw-initiation regions of the motor body was then 
implemented. However, failures have continued to occur even in the 
fiberglass wrapped bodies at failure rates significantly greater than those 
considered acceptable by the Army. 
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LIGHT ANTITANK WEAPON 



FIGURE 13 The M72A2 LAW system (Bruggeman 1981) . 
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FIGURE 14 Fiberglass-wrapped LAW rocket motor (Bruggeman 1981). 
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FIGURE 15 Schematic representation of typical LAW rocket motor 
malfunction (Bruggeman 1981). 
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Detailed failure investigations have indicated that the primary cause 
of the failures was the unusually low fracture toughness of the high 
strength aluminum alloy 7001-T6 of which the rocket motor and closures 
were fabricated (average toughness on the order of 10 ksi /TnT with 
measured values as low as 7 ksi /TnT). The problem was aggravated by the 
susceptability of the material to stress corrosion cracking, which 
produced enlarged flaw sites. The occurrence of different failures rates 
among LAW systems from different manufacturers was investigated, but only 
subtle differences in manufacturing processes were observed. It was 
concluded that the problem was basically one of poor material selection 
rather than one of poor manufacturing or quality control. 

Possible Effects of a Structural Integrity Plan 

Had a structural integrity program like that outlined in Chapter 2 been 
in place during the development of the LAW system, the first step would 
have been to identify components critical to life and mission, which 
would have clearly included the rocket motor and closure components. 
Identification of design loads and environment would have been similar to 
the procedure actually used, but an additional step of assuming some 
damage to be present would have been included as input to the design 
analysis. This may have identified the stress corrosion mechanism, with 
some controls on levels of residual stress or crack propagation rate. As 
a minimum, a design basis flaw would have been assumed, and fracture 
mechanics calculations performed to determine minimum acceptable material 
fracture toughness. Fracture toughness measurements would then have been 
part of the material selection process, and it is likely that aluminum 
alloy 7001-T6 would have been shown to be unacceptable for the intended 
usage. If an acceptable alternative material could not be identified, 
compromises would have been made, in terms of either increased weight or 
reduced performance requirements to reduce stress, * Finally, even if the 

above changes were not implemented during intial design, improved 
in-service structural integrity controls might have provided better 
feedback from the initial series of structural failures such that more 
effective "fixes'* could have been implemented in later production runs. 


CASE STUDY: M60 TANK 

History 

Until sufficient quantities of the Ml (Abrams) tank are produced the Army 
will continue to rely on the M60, developed in the 1960s, as its 
principal heavy tank. To increase the effectiveness of the M60 during 
this interim period, the Army has undertaken a major "rebuild" program. 

In December 1981, the M60 program manager expressed concern about the 
reliability of various components of overhauled tanks as a result of 
failures experienced during proving ground tests. In response to that 
concern, one of the Army laboratories formed an interdisciplinary task 
group consisting of specialists in materials science, engineering, 
structural mechanics, nondestructive testing, and statistical analysis. 
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This group was chartered to evolve life prediction methodology for 
application to a structural component of the M60 tank. The torsion bar 
was chosen for the application because failure of bars was of concern and 
because a fairly comprehensive history was available. 

Failure of a torsion bar in an M60 tank does not generally result in 
an accident that threatens life; however, if a failure occurs during a 
dangerous maneuver, the ensuing accident could! Most often, torsion bar 
failure results in reduction of mobility that, in turn, affects the 
mission success. Furthermore, even if mobility is only reduced and not 
lost, the failure of a bar results in other bars being loaded beyond 
design limits, thereby accelerating total loss of mobility. Exacerbating 
the situation is the Army M60 maintenance policy; bars are simply 
replaced at fixed intervals and no records of individual torsion bar 
service history are kept. 

Given the unsatisfactory failure history of the M60, the program 
manager wished to "develop a position with regard to durability of 
reconditioned vehicles, and feasibility of predictive testing as part of 
the overhaul process." In effect, the goal was to implement a structural 
integrity program. 

With this background the Army laboratory's task group undertook the 
assignment of developing a life prediction methodology for assuring the 
structural integrity of the M60 torsion bar. Information and data were 
collected from the U.S. Army Tank-Automotive Command, Anniston Army 
Depot, Army Systems Analysis activity, Aberdeen Proving Ground, and 
relevant contractors. These included failure data, failed torsion bar 
tests, fatigue data, quality assurance procedures and load spectra. 

The approach taken by the task group involved materials 
characterization, stress analyses, probabilistic design studies, 
sensitivity analyses, and analysis of failed components. It was found 
that failures inevitably were initiated within the splines at the ends of 
the bar, even though the final fracture surfaces extended into the body. 

The characterization of the torsion bar material was quite extensive 
and included chemical analysis, light microscopy, analysis of retained 
austenite, hardness traverse, tensile properties, Charpy properties, and 
fracture toughness properties. The initial intent was to use fracture 
mechanics analysis and knowledge of the fracture toughness of the 
material to determine an allowable flaw size that could be used during 
depot or unit level maintenance to decide whether or not to replace a 
torsion bar. 

It was quickly determined by the task group that inspection for an 
allowable flaw was not a feasible approach for the torsion bar. The bulk 
of the life of a bar involves the coalescence of microcracks into a 
macrocrack. The analysis indicated that cracks as small as 0.005 inches 
would propagate to final fracture in about 15 miles of travel. Since 
reliable detection of flaws that small is not possible even under 
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controlled laboratory conditions and since scheduled maintenance is not 
carried out every 15 miles, an alternative approach had to be pursued. 

The alternative approach consisted of statistically analyzing the 
extremely comprehensive fatigue data generated by torsion bar 
manufacturers in conjunction with load spectra information and making 
probabilistic life predictions. Using this approach, the life of a 
torsion bar was predicted to be 292 miles with 99 percent probability 
(i.e., on the average, only 1 bar out of 100 would fail before 292 
miles). The prediction was consistent with actual failure information 
from Aberdeen Proving Ground, which showed a 99 percent survivability of 
262 miles. 

A number of sensitivity analyses were carried out. These addressed 
such questions as the effects on life of various material properties, 
stresses in the torsion bar, etc. For example, by redesigning the bar to 
reduce the stress level by 20 percent, a fourfold increase in life can be 
obtained (Figure 16). On the other hand, increasing material properties, 
such as fracture toughness, resulted in only marginal improvements 
(Figure 17). 


Probability of Survival vs Miles 



FIGURE 16 Life of tank torsion bars as a function of stress (Neal, 
Matthews, and DeAngelis 1983). 
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FIGURE 17 Influence of material improvement on service life (Neal, 
Matthews, and DeAngelis 1983), 


One interesting problem faced by the task group involved obtaining 
load spectrum information. No load spectra for the M60 could be found 
and it was necessary to adapt load spectra that were available for the 
new Abrams tank. The gross weight of the tanks is not identical and the 
wheel-suspension characteristics are different. However, an engineering 
analysis to approximate the M60 spectra was considered satisfactory since 
the spectral data were skewed toward higher loads — that is the bulk of 
the load was not highly variable. The conclusion was borne out by the 
good agreement between the predicted survival estimate and proving ground 
results. 

Possible Effects of a Structural Integrity Plan 

It is clear that if a structural integrity plan had been implemented 
during the development of the M60, the problems that occurred would have 
been identified. It is possible, but not likely, that the torsion bar 
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could have been designed so that an allowable flaw approach for torsion 
bar replacement would have been feasible. It is more likely that 
trade-off studies would have been made of operating stress and materials 
selection with the associated costs and weight implications related to 
the probabilistic estimate of life (with the associated logistics and 
maintenance implications) • 

After the fact, the implementation of structural integrity offers far 
less flexibility. The options are: 

1. To replace bars only after they fail. Although this may be an 
acceptable option in peacetime (i.e., training) operations, it would be 
risky in wartime conditions. Since there are 12 torsion bars on the M60, 
after 500 miles there is about a 30 percent probability that on a given 
tank all bars will have survived. However, with another 100 miles of 
service the likelihood of a bar failing is now one out of two; after 200 
miles, three out of four! 

2. To replace all bars on a scheduled basis. The schedule would be 
based on a trade-off between desired (probabilistic) availability of the 
M60 with the logistics costs of replacement at various scheduled mileage 
accumulation. The problem here is one of scheduling replacement to be 
compatible with existing scheduled maintenance requirements for the 
myriad of other components. 

3. Replace bars selectively on a scheduled basis. This implies that 
maintenance records be kept on all bars. Specifically, if a bar is 
replaced because of failure, the replacement bar's probabilistic life 
estimate would be factored into the next scheduled maintenance. This 
would require maintaining records of nonscheduled replacement of bars. 
Manual records would be expensive and of questionnable reliability. 
Application of sensors on individual bars and/or on-board microprocessors 
for data accumulation could be quite cost-intensive. 

4. To redesign to adjust (probabilistic) life with overall 
maintenance schedules. Redesigning after the fact inevitably creates 
many problems, most of which result directly in increased costs. 

Trade-off studies have not been performed to quantify these costs. 

The substance of what has been discussed has been directed to only 
one component of the M60 tank. There are many other structural elements 
of the system that contribute to the overall structural integrity of the 
M60 tank. Even restricting attention to the track and suspension 
subsystem, there are numerous other issues, such as track-pads and track- 
pins. The problems with these other components are analogous to those 
with the torsion bar. In the case of the (rubber) track-pad, 
specifications for the material are not sufficiently spelled out. In the 
case of track-pins (which connect individual track segments) the 
situation is analogous to the torsion bar; it is impossible to detect 
allowable flaws in the pins. 

A system-wide structural integrity program for the M60 would have 
provided the Army with the means for making cost-effective decisions 
during the development of this vehicle. 
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CASE STUDY: COPPERHEAD 

History 

Copperhead is a cannon launched guided projectile (CLGP) fired from a 
155-mm cannon. It is manufactured for the Army by Martin Marietta 
Corporation. During test firings the control section (Figure 18) failed 
on some of the projectiles. The control section was produced from a 4340 
steel with a specified hardness of R c 52-55; the corresponding yield 
strength is approximately 250 ksi. Martin Marietta believed that the 
high material strength requirement was necessary to meet the high 
operational stress requirements. However, higher strength also means 
lower toughness and the failures appeared as a result of inadequate 
toughness in the presence of defects. 



FIGURE 18 CLGP structural configuration (Bluhm and Freese 1978). 

Personnel from the Army Materials and Mechanics Research Center 
(AMMRC) used fracture mechanics principles to estim ate a critical defect 
size. Based on an estimated minimum Kj c of 30 ksi /in. and 200 ksi 
operating stress, a defect size of 0.01 in. by 0.03 in. would be 
critical. A program to develop nondestructive testing (NDT) procedures 
for detecting these defects was suggested, but many felt that it would be 
impossible to detect such small defects with any regularity. Other 
complicating factors were that neither the exact toughness of 4340 steel 
nor the correct stress requirements were known very well. 

Possible Effects of a Structural Integrity Plan 

A structural integrity plan based on fracture mechanics principles could 
have greatly helped to avoid the firing test failures and to minimize the 
possibility of field failures. A schematic of the fracture mechanics 
approach is shown in Figure 19. Three elements are required; stress 
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Material Properties 



FIGURE 19 Areas of information required in the utilization of fracture 
mechanics technology. 


analysis, defect sizes, and material properties. A structural integrity 
plan would consider these three elements and make compromises to arrive 
at a design for the control section that would have a margin against 
failure. 

The material strength level was specified to insure a margin against 
plastic overload of the control section. This was based on an estimated 
stress analysis rather than an exact one. The maximum stress 
requirements should be known before the material strength level is 
specified. The failures experienced in test were from inadequate 
toughness rather than plastic overload. Strength and toughness are 
inversely related in a 4340 steel. If toughness is inadequate, strength 
requirements must be reduced. With an accurate stress analysis, these 
compromises can be made rationally. 

To make a full analysis of the design, NDT inspection capabilities 
must be considered. Critical defect sizes of 0.01 in. cannot be found 
repeatedly. A more reasonable inspection limit must be proposed. This 
could be a starting point for the fracture mechanics evaluation. The 
approach taken could then be as follows: Given a maximum defect size 

that might be missed by inspection and the required design stress, a 
required toughness level can be determined. A small materials test 
program could be initiated to determine toughness versus strength for 
this material. These results would identify the maximum strength level 
of the material that can still meet the toughness requirements (obviously 
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the 250 ksi strength is too high to give the needed toughness). If it 
turns out that this strength level is inadequate to meet the stress 
requirements (danger of plastic overload), some further compromise is 
needed (e.g. , the design must be modified to lower the stresses or a new 
material must be substituted to meet both the required strength and 
toughness levels). 

The procedure needed to implement this structural integrity approach 
is well established and known to guarantee structural reliability. It 
must be implemented based on a knowledge of all three factors in the 
fracture mechanics approach (Figure 19). Stress analysis must be 
conducted to get accurate stress requirements. Material properties must 
be determined through a test program rather than estimated from the 
literature. A realistic inspection limit must be established; this 
depends on the facilities and the accessibility of critical areas on the 
structure. Finally, if the structural integrity analysis shows that 
failures are possible, compromises must be made in the design or material 
selection for the component. Putting this effort into the initial design 
and evaluation could be very cost-effective by reducing or eliminating 
failures. Repeated failures could require a redesign and possible 
scrapping of manufactured components. The end result could be orders of 
magnitude more expensive than a simple structural integrity plan 
implemented in a timely manner. 


CASE STUDY: NUCLEAR SHELL 

History 

Failure of the JFF-1 engineering development test (EDT) projectile during 
test firings in December 1976 appeared to result because the threaded 
joint between the rocket motor and the bulkhead of the XM-753 projectile 
did not hold together. Therefore, the joint between the rocket motor and 
the bulkhead of the projectile had to be redesigned. The successful 
solution of the joint problem was developed through the combined efforts 
of the Army Armament Research and Development Command (ARRADCOM), Sandia 
Livermore Laboratories, and the Army Materials and Mechanics Research 
Center (AMMRC). The new joint design used a total of 16 pins held in 
place by snap rings (Figure 20). 

Effects of a Structural Integrity Program 

The AMMRC was assigned the task of verifying the structural integrity 
of the new joint design based on the requirements of the ARRADCOM 
configuration manager. These design requirements for structural 
integrity included: 

1. Peak set-back and torque at 10,400 g, under impulsive torque 
resulting from free run and under negative set-back (elastic release) at 
barrel exit. 

2. Pin retention under centrifugal force at barrel exit. 




FIGURE 20 Test firing of XM-753 projectile with pin joint using snap 

ring retainers (courtesy of J. Adachi, M. Benicek and T. Tsui 
Mechanics and Structural Integrity Laboratory, Army Materials 
and Mechanics Research Center). 
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3. Gas pressure of 3000 psi at rocket-motor-on condition* 

4. Equal bending stiffness of the threaded joint* 

5. Pin extraction and joint disassembly and reassembly without 
damage to components. 

6. Control of pin interferences and bulging effect on seal 
surfaces. 

7. A reliable propellant gas seal at the joint. 

The design effort utilized finite element analysis, photoelastic 
analysis, and firing tests of the bulkhead-to-structural case joint and 
analyses and tests specifically developed for evaluation of possible pin 
joints. The results of the analytical analyses were verified by 
experimental tests to ensure that the results were reasonable. The study 
went beyond the normal structural analysis and evaluated the overall 
reliability of the pin joint between the rocket and the bulkhead of the 
projectile. 

In reviewing a new projectile design, there are a number of groups 
which must interact in order to develop a functional yet reliable 
projectile. The design drawing for the proposed projectile comes from 
ARRADCOM along with the design specifications that the configuration 
manager deems needed. These may include maintenance requirements, 
interchangeability of parts, range and projectory, payload, classified 
requirements, and launch conditions. The Department of Energy prepares 
the physics calculations to ensure that the design can carry the required 
payload • 

AMMRC is tasked with defending the structural reliability of the 
design before the ARRADCOM Nuclear Weapons Safety Committee. In order to 
properly defend the design, the AMMRC does a complete stress analysis of 
the design. 

Three dimensional analyses are conducted on the design and critical 
parts identified. The analysis will not only include mathematical 
calculations but also experimental testing of hardware to verify initial 
analytical results. Efforts are made to identify other materials that 
would be more appropriate to the design specifications. Criteria used 
during this evaluation might include: yield strength, brittle fracture, 

buckling modes. All of this activity is directed at maintaining the 
structural reliability of the projectile. Other failure modes also might 
be identified during these activities and will be communicated to the 
configuration manager for his consideration. AMMRC will provide critical 
quality assurance criteria based upon the preliminary design of the 
projectile in order to maintain the reliability of the structure. These 
criteria would assist in establishing the limits on the contractor's 
manufacturing processes and specifications for the materials used. 
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Throughout this process of developing a new projectile, it is 
apparent that the configuration manager must believe that the activities 
of AMMRC on the project serve his interests. This type of cooperation is 
created when all parties involved are willing to listen to the others’ 
concerns and to compromise on design specifications in order to develop a 
functional and yet structurally reliable projectile. 


COMMENTS ON ARMY ACQUISITION PRACTICES 

Within the U.S. Army material development and acquisition process, 
project managers are assigned responsibility for managing that activity 
under specific charters approved by the Secretary of the Army. Unless 
specifically addressed by charter, there is no formal procedure for 
mandating the implementation of structural integrity plans. 

Consequently, structural integrity assurance is a matter most often left 
to the judgment of the individual project manager. As the case studies 
presented in the preceding pages indicate; a well planned, comprehensive 
structural integrity program has been implemented in some instances and 
not in others. 

As in industry and the other services, the Army project manager is 
faced with the conflicting demands of cost, schedule, performance, and 
reliability. Up to any three of these attributes can be established 
explicitly but the fourth will seek its own level (Coutinho 1977). 

Within the Army system the typical project manager is assigned for about 
three years and then is reassigned. Hence, cost and schedule become the 
drivers in the acquisition process since these are attributes that can be 
measured readily and are used in evaluating the project managers 1 
performance. It is little wonder that structural integrity is not always 
explicitly factored into the development process and is not the most 

important issue to the project manager since the odds are high that it 
will not become a problem during his tenure. 

Furthermore, in the development of modern systems, high technology 
often becomes the focus for management of the development. Materials and 
structures technologies are often taken for granted and languish in the 
background until a problem arises. When a structural integrity (or 
structural reliability) problem does arise, the options for solving it 
are constrained because the design is so far down the road. The result 
is that the solutions are not optimal and generally have an adverse 
impact on the other attributes. 

For example, life-cycle cost will suffer when an after-the-fact 
structural integrity solution is implemented. The schedule is certainly 
delayed by an unanticipated structural failure. Because an optimal 
solution is not possible, performance often suffers. 

Although the Army has the technical capability to deal with most of 
these problems through competent laboratory staff, there is no mandated 
requirement for the project manager or his staff to avail themselves of 
such resources. Further, although industrial suppliers may apply 
structural integrity concepts in producing products for sale under their 
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own name, there is no requirement that such practices be used in 
supplying equipment for the Army* 

The problem, then, would appear to be the lack of a structural 
integrity program that is institutionalized in the Army acquisition 
system* For example, the Air Force structural integrity program is 
firmly embodied in Air Force regulations to cover "cradle to grave" 
airframes procurement, but no such program is in place in the Army. 
Although some project managers may introduce some structural integrity 
controls, the system has not been formalized. Until such procedures are 
introduced, there is no guarantee that the problems of failures, 
excessive costs, and fatalities arising from present practices cause will 
disappear. 
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PROPOSED STRUCTURAL INTEGRITY PROGRAM FOR THE ARMY 


REGULATION 

The case studies presented in the preceding chapter illustrate a need for 
the Army to institutionalize structural integrity. It is recommended 
that the Army develop a formal procedure that requires the consideration 
and implementation of a structural integrity program. This procedure 
should be mandated by the Department of the Army and incorporated into 
the Army regulations. The intent is to ensure that program managers 
recognize their responsibility for structural integrity and that explicit 
consideration be given to this aspect early in the concept definition 
phase. The intent of the regulation should be to lower the probability 
of discovering costly structural integrity problems late in the 
development cycle or after the system has been deployed. 

SCOPE OF COVERAGE 

The Army produces and procures a large variety of equipment and systems 
with widely differing structural reliability consequences. Therefore, a 
unique structural integrity plan should be prepared for each system 
acquisition considering its specific application and the consequences of 
structural failures within that system in terms of human life, mission 
success, and economics. The results could range from a highly detailed 
and comprehensive plan for fracture critical systems or components to 
minimal plans for components deemed by the project team to be of small 
consequence or not fracture critical. In extreme cases, a structural 
integrity plan may be waived entirely, but this should involve a 
conscious decision to do so. 

Given the flexibility permitted by this recommendation, the committee 
is strongly of the opinion that a knowledgeable organization outside 
project management should be assigned review and approval responsibility, 
including review and approval of decisions to waive development of a 
structural integrity plan. 
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Thus, structural integrity plans would become a key element of the 
procurement or production process for the system and would be included in 
relevant contracts and specifications. Major considerations in the 
preparation of such plans should be developed and documented in a generic 
military standard (Army Structural Integrity Program) as described in the 
following pages. 


MILITARY STANDARD 

The recommended Army regulation should refer to a new military standard 
that defines a structural integrity program considered generic for all 
Army equipment. This generic structural integrity program should be 
developed to include structural design conditions, materials and 
processing controls, design and analysis controls, quality assurance 
controls, and in-service controls. In developing this new military 
standard, the Army should define how its structural integrity program is 
time-phased relative to the design, verification, production, and 
operational phases of the equipment lifetime. The Army structural 
integrity program should be sufficiently general that it defines 
structural integrity requirements and outlines the essential features of 
a satisfactory (adequate) structural integrity plan for a given 
procurement. It is essential that the new military standard give serious 
consideration to how structural integrity requirements will be verified 
prior to acceptance of design for production release. Chapter 3 provides 
a number of examples of structural integrity programs that might be 
reviewed for their relevance to this new military standard. 


IMPLEMENTATION 

It is the committees 1 belief that the Army must develop its own 
structural integrity plan reflecting the specific character, 
organization, and operational procedures unique to that branch of the 
service. Implementation should be by directive from the highest level of 
the Army. The committee has not involved itself with the details of the 
organization and operational aspects of such a plan for the Army, 
considering this to be outside its area of knowledge and experience, but 
recommends that such be done by the Army itself, following closely the 
guidelines given in this chapter. 


PAYOFFS 

The importance to the Army of operating with a structural integrity 
plan involves far more than the mere practice of sound engineering 
principles. The committee has identified six factors that could be used 
to measure possible payoffs from the introduction of such procedures into 
the procurement process: 

1. Cost — Although the "costs" of a malfunctioning or otherwise 
defective part are difficult to measure, they can be very high. For 
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example, as indicated in Chapter 1, the cost of fractures each year in 
the United States has been estimated to be in excess of $100 billion with 
some $6 billion of that directed to the DOD. 

2. Safety — Protection of the public as well as military personnel 
against a serious accident involving Army weapons is of prime 
importance. Of special concern are those systems involving nuclear 
weapons. However, the more conventional weapons (e.g., the LAW and 
artillery) are also of concern since premature ignition of projectiles or 
inadequate toughness and sudden fracture of gun barrels can lead to 
injury and loss of life. Problems associated with loss of confidence and 
morale of operating personnel can also result if the accident rate is 
high. 


3. Readiness (reliability and performance) — An inoperative weapon or 
vehicle at a time of national emergency is an extremely serious problem. 
Although difficult to quantify in dollars, there can be no justification 
for the existence of a weapons system that is not available for use in 
time of need due to a "structural failure." 

4. Visibility— The unsuccessful performance of a new weapons system 
during its various trials prior to commission can generate unfavorable 
publicity that has serious consequences in terms of both public and 
congressional opinion concerning the capability of the Army to undertake 
and satisfactorily complete such projects. Although a structural 
integrity plan will not prevent all possible operational problems, it can 
help avoid many of these embarrassments. 

5. Maintenance — Undue maintenance because of repeated malfunction 
can have serious economic and operational consequences. Skyrocketing 
repair costs have serious budgetary consequences. Excess downtime means 
more equipment must be procured to perform a given function. Breakdowns 
in remote locations are extremely costly. 

6. Politics — A positive attitude in the mind of the public and 
particularly the Congress is highly desirable if a given weapons system 
is to be adequately funded. The several factors given above all 
contribute to the development of this attitude. 

The four weapons systems described in Chapter 4 have been examined in 
terms of these factors and it was concluded that a more comprehensive 
structural integrity plan in place in advance would have prevented or 
could have prevented the difficulties experienced. An attempt has been 
made by the committee to evaluate the several payoff factors described 
above for each of these systems. This evaluation was aimed at measuring 
the relative importance of each payoff factor on a scale of one to six, 
where one is most important and six the least important of the several 
factors identified. While only representing the views of the committee, 
it was clear that safety was the most important of the various payoff 
factors and maintenance the least. While other groups might come up with 
a different ranking, ours was, in order of importance, safety, readiness, 
political factors, cost, visibility, and maintenance. 
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